using ZB.MOM.WW.Secrets.MasterKey;

namespace ZB.MOM.WW.Secrets;

/// <summary>
/// Application-level configuration for the ZB.MOM.WW secrets subsystem: where the SQLite store
/// lives, how the master key (KEK) is resolved, whether the schema migration runs on startup, and
/// how long decrypted values are cached. Bound from a
/// configuration section by <see cref="DependencyInjection.SecretsServiceCollectionExtensions.AddZbSecrets"/>.
/// </summary>
public sealed class SecretsOptions
{
    /// <summary>The path to the SQLite database backing the secret store. Defaults to <c>secrets.db</c>.</summary>
    public string SqlitePath { get; set; } = "secrets.db";

    /// <summary>The master-key (KEK) resolution configuration. Defaults to a fresh <see cref="MasterKeyOptions"/>.</summary>
    public MasterKeyOptions MasterKey { get; set; } = new();

    /// <summary>
    /// When <see langword="true"/> (the default), the SQLite schema migration runs at application
    /// startup via the hosted service. The migration is idempotent, so repeated restarts are safe.
    /// </summary>
    public bool RunMigrationsOnStartup { get; set; } = true;

    /// <summary>
    /// How long a decrypted secret value is cached in process memory by the resolver. Kept short by
    /// default (30 seconds) because the cache holds plaintext secret material.
    /// </summary>
    public TimeSpan ResolveCacheTtl { get; set; } = TimeSpan.FromSeconds(30);
}
